Comment by pacificpendant

Did you find that after reading https://labs.hakaioffsec.com/nginx-alias-traversal/ by any chance?

Semgrep has a nginx ruleset too https://semgrep.dev/p/nginx